Concerned with software or hardware firewalls

learn more… | top users | synonyms (1)

2
votes
1answer
195 views

Consequences of using -s and -d arguments in iptables

We are studying iptables for a Computer Systems Security course. We are confused as to what happens when the -s and -d arguments are both used in the same rule, such as: iptables -A OUTPUT -s ...
2
votes
2answers
430 views

Enterprise IDS - Deployment & Uses

I am investigating deploying the Snort IDS for an enterprise environment. This environment consists of a NOC that manages several servers, mainly internal but some internet facing. There are several ...
2
votes
2answers
473 views

Why wouldn't the reverse shell connect back using the same port that exploited the server?

The reverse shell payload from msf use a new port to connect back to the attacker, therefore if the target server has outgoing filters, attack would fail. i.e established server:ftp <-> ...
2
votes
3answers
1k views

Firewall Migration: NetScreen NS500 to FortiGate [closed]

I have recently been tasked with doing a firewall migration from an old NetScreen NS500 box to a FortiGate device (I believe it will be a 60C). I am sure most of you aware that NetScreen boxes are no ...
2
votes
1answer
62 views

Do the firewall hardware specifications have to be better than the network it protects?

If I need a bodyguard I'll have to hire someone whose muscles are much tougher than mine. If a server can't handle a DoS/DDoS attack because it consumes it's resources does this mean the firewall has ...
2
votes
1answer
101 views

Best practice in securing a web server and an offsite worker

Suppose I'm hosting a web server and a separate box offsite that crunches data. The web server interacts with the worker using the worker's API over port 2888. What would be the design of a secure ...
2
votes
3answers
216 views

Where to place a vulnerability scanner within a data center

There is currently a debate in my office on the best location to place a vulnerability scanner (a distributed scanner - Rapid7 Nexpose, using scan engines) within a data center. I see two options: ...
2
votes
1answer
42 views

Virtualisation: security on the host side

Virtualised environments are focused on isolating the guest OS. Using the VirtualBox model, the guest might be behind a virtual NAT and/or talk only with other VMs via internal networks, and only ...
2
votes
3answers
446 views

Suspicious VMWare connections that bypass firewall

I'm running VMWare 5 and I have found that when I start up VMWare I see two connections: TCP 10.100.100.161:55555->as-40816.engx.vmware.com:https (ESTABLISHED) TCP ...
2
votes
1answer
297 views

How are IaaS Virtual Machines Isolated?

I am currently examining Hypervisor firewalls for my graduate thesis, but I unfortunately don't have a lot of experience with IaaS environments. How are IaaS Virtual Machines network isolated from ...
2
votes
1answer
953 views

Why are some ports reported as closed by nmap?

I was scanning a machine from inside the same LAN which is running and up to date Windows XP Home Edition which I suspect may be running some malware. The target machine has an up to date antivirus ...
2
votes
2answers
3k views

What is more risky? Database Server in DMZ or Trusted Network?

Hoping this is not a dupe of any of the related database / DMZ questions, but I don't think any of them answered my question sufficiently. Assume the following A web server is being used for ...
2
votes
3answers
8k views

Config Server Firewall: What Outgoing ports need to be open for wget and apt-get install?

I am just configuring CSF and I have to specify my outbound ports here. I am trying to close as many as possible leaving only what I need open, however what do I need to leave open for wget? # Allow ...
2
votes
2answers
243 views

Project help required by a newbie!

Basically, I'm doing a degree in network computing and am currently working on my dissertation right now. I am not an expert with networking yet, so I'm kind of struggling to get started with my topic ...
2
votes
2answers
102 views

Connecting trusted and untrusted networks

We have two domains that are isolated. First domain is the Corp LAN, the second is an hostile untrusted network with untrusted clients that could contain malware. Clients on the untrusted network ...
2
votes
4answers
86 views

Do I need antivirus for this unusual installation - or just firewall?

I'm donating an old Windows XP laptop to a school. The machine will spend its golden years doing only one thing - a process that consists of just three steps: Recording lectures and discussions ...
2
votes
1answer
61 views

Which IPTables chains should I log from a security perspective

So far I've always been logging the INPUT and OUTPUT chains because I only used iptables as host firewall. Now I'm configuring network firewall which uses iptables, but I don't know whether I should ...
2
votes
1answer
1k views

Expose web service in a secure manner

Requirement I have a web service I need to expose on the DMZ for external communication. The web service communicates directly with a critical database that sits on an internal net. Current ...
2
votes
3answers
151 views

State before getting whitelisted?

There is a data flow of incoming files (from untrusted, external sources), that get whitelisted by a kind of application layer firewall. Is there a common name for the state of the files before they ...
2
votes
1answer
243 views

What security risks are involved with sending data over the internal network on Rackspace Cloud servers?

What are the risks involved with sending unencrypted data over the internal network with Rackspace Cloud Servers? Assume the interfaces use iptables to filter IPs and ports so they only accept data ...
2
votes
1answer
9k views

How does pfsense block torrent traffic?

I know that pfsense is a very effective tool for restricting bit torrent traffic. I was wondering how it actually manages to do that ? There's not much information available on this. The more ...
2
votes
2answers
467 views

Anomaly based web application Firewall

How practical are anomaly based web application firewall in mitigating web based attacks ? Which types of threats do they mitigate against and which don't they? Are their any practical implementation ...
2
votes
1answer
168 views

Understanding OpenWRT LuCI Firewall Routing with VPN

I'm still fairly new to networking, and I'm having a little trouble grasping some concepts of the proper firewall rules I need to implement for my desired setup. I'm setting up a router with OpenWRT ...
2
votes
1answer
99 views

Understanding nmap output / author explanation …(Scapy)

I just read this example and explanation (below) in the OReilly book Security Power Tools (2007) in section 6.3 that is written by the creator of Scapy, Philippe Biondi. I think the example is very ...
2
votes
1answer
314 views

Using Linux iptables to implement a stateless, packet filtering firewall

When I began my career in network security, almost a decade back, the industry standard was stateful firewalls that even had the ability to inspect some application layer protocols. I had only heard ...
2
votes
2answers
142 views

Is there a trusted independent firewall review company?

I don't know how to write this without it sounding like a plug (lol), but it's not. So please don't close-vote it, even if you really want your editor badge. Here goes: There's this site called ...
2
votes
1answer
67 views

Should reverse connections be used to bypass NATs?

I'm planning on doing a demonstration on how remote administrative tools work for my schools computer security club. I plan on writing a RAT in C++ and demonstrating/explaining how it works. I ran ...
2
votes
1answer
109 views

Is it possible to track the email sent via BCC List using firewall or network security software?

I want to know whether is it possible to know the conversation/email sent via BCC can be identified by admin in some corporate companies? I have heard that email sent from BCC cannot be identified, ...
2
votes
1answer
426 views

IPS/IDS and Firewall Solution(s) to a Small Office

I was tasked with implementing a network security solution for a small real estate agency. They are a typical old-school mom and pops shop, about 15 employees with basic file sharing, printing, and ...
2
votes
1answer
139 views

Setting up NAT with firewall for RDP connection

I have a vendor who needs to connect remotely to one of our servers. What I thought I would do is setup a NAT rule in our firewall. I have a public IP address that I will have translated to the local ...
2
votes
2answers
691 views

Mixing stateless and stateful firewall rules

I have been advised that mixing firewall rules that are both stateful and stateless can lead to trouble when it comes to troubleshooting. Is there any truth in this? Take the following two rule sets ...
2
votes
2answers
308 views

Barracuda antispam access to active directory in dmz : opening port or not?

I have a Barracuda Antispam unit and look to use recipient validation with active directory to stop sending NDRs (non-delivery reports) when we are being spammed. What I see on the web is people ...
2
votes
1answer
272 views

Normalizing Windows Advanced Firewall rules

How can I best normalize our Windows Advanced Firewall rules while implementing network segmentation? I want them to be as clear and concise as possible for audit purposes. What few examples I've seen ...
2
votes
1answer
98 views

Quick Security Mitigations to Impending attacks

Suppose you are the sysadmin, and you know of an impending attack that just started or about to start soon. You can either wait it out, or try a few tricks and quick mitigation to fend off attackers ...
2
votes
2answers
425 views

How to define different firewall rules for different users on the same machine running on Windows 7?

Provided that one machine running on Windows 7, connected to LAN, and connected to the Internet via a gateway in the LAN. There are two logon user accounts A and B on the machine. I want: 1, User A ...
2
votes
2answers
558 views

Does an equivalent for netconf exist in the Cisco ASA world?

I'm looking for a method to send instructions to a Cisco ASA without writing scripts to execute on the CLI over SSH. Cisco doesn't seem to support netconf or xml-pi on the physical ASAs (only their ...
2
votes
1answer
6k views

How to block all access to Akami deploy servers and Apple push servers?

I no longer blindly trust the numerous connections that occur at night and during the day that always go to "content" and "push" servers like: a23-33-37-54.deploy.akamaitechnologies.com ...
2
votes
1answer
281 views

IDS/WAF scenario for 2 web servers

I'm running 2 web servers on 2 different physical hosts at home. They handle both HTTP and HTTPS traffic. I want to protect against web application attacks, but don't want to spend money for ...
2
votes
1answer
526 views

Large lan party : How to identify the users on the network?

I would like to know what are the good way to identify users on a large lan party when you manage network ? I had the idea to make the users register them self at a desk, they give us Firstname, ...
2
votes
1answer
172 views

Firewall Considerations with PGP Universal

The PGP Universal server is a fairly complex piece of work that provides several different services. When constructing firewall rules I am trying to determine what implications there are for opening ...
2
votes
1answer
3k views

Something causing Sonicwall to throw Smurf Amplification Attack Warning?

I set up a new laptop recently and, after installing various developer tools, it started causing our Sonicwall firewalls to issue an alert email whenever the laptop connected to the network. The ...
2
votes
1answer
2k views

How should I configure a Citrix Netscaler to protect against HTTP, TCP, or UDP flood attacks?

I have a Citrix Netscaler and want to configure the appliance appropriately so that it can protect my hosts from a DDOS. Is this something I can do here, or must I take action on the host itself?
2
votes
3answers
2k views

Use a Common Firewall for two Different Subnets

I want to implement a security scheme in a new network configuration. There are two buildings for the client: Office Building 1 (OB1) with address 10.0.0.0 / 255.255.255.0, Gateway 10.0.0.1 ( ...
2
votes
2answers
340 views

What compliance framework is appropriate for firewalls

As a more corpose vulnerability assessment and penetration test, one step of our activity is to review from a security perspective the policy of some firewall. In our society we have a deep ...
2
votes
0answers
40 views

Can NATs and firewalls blacklist IPs when trying to UDP hole punch?

I am developing a P2P application that will make use of UDP hole punch to connect two peers behind NAT. When dealing with connections between a cone and a symmetric, unpredictable NATs, however, hole ...
2
votes
0answers
36 views

Windows Firewall single rule with multiple IP addresses vs multiple rules with single IP address [closed]

I've tried finding some resources to help me on my dilemma, but wasn't successful in my approach. So here goes: I am implementing an automated firewall manager for Windows Firewall which will ban ...
2
votes
1answer
271 views

Firewall and Torrent

I use my university internet network and all incoming connection is blocked on every port.(they use netasq firewall) They have no other restrictions which stops me from using a torrent client. Using ...
2
votes
1answer
186 views

How to block traffic coming from an “public” WiFi hotspot and going to the LAN (iptables)

I followed this tutorial (http://elinux.org/RPI-Wireless-Hotspot) for an Wifi Hotspot in the guesthouse. This is working fine, but every device on the WiFi network can reach any LAN device in the LAN ...
2
votes
0answers
391 views

cisco asa syn flood detection and response not working

I have a Cisco ASA 5510 (ASA Version 8.3(2)) that has been getting a syn flood attack on it (or more accurately through it - targeting a host behind it) a couple of times a day for the past few days. ...
2
votes
1answer
66 views

How do you back up cardholder data remotely without a network connection?

In the PCI DSS version 3 it says: 1.3.3 Do not allow any direct connections inbound or outbound for traffic between the Internet and the cardholder data environment. But in the event of hard ...